CVE-2026-19948

Name of the Vulnerable Software and Affected Versions The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates versions prior to 2.2.18

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can retrieve sensitive information about WooCommerce products that are not intended for public view, including those with draft, pending, private, or catalog-hidden statuses. The leaked data includes the product name, price, short description, image URL, permalink, stock status, and product type. This is possible because multiple block renderers emit the sidebarNonce value into public page HTML without a login gate, allowing visitors to harvest a valid nonce and bypass the authentication check in the handler.

Recommendations Update the plugin to version 2.2.18 or later.